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International Bureau (PCT Rule 17.2(a)). 
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noted below. Failure to timely comply will result in ABANDONMENT of this application. 
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1. 



The RCE of 10/19/05 has been received and entered. 



2. 



Claim 4 is pending. 



Reasons for Allowance 




3. Claim 1 rocitog: 

Granger, US patent 6643775 discloses a method for obfuscating computer program instructions 
upon disassembly, the method comprising: 

• Inserting an obfuscating instruction for causing a disassembler to not disassemble one or 
more bytes subsequent to the obfuscating instruction. (Column 19, lines 5-22) 

and 

• Inserting a branch instruction to invoke execution of one or more bytes subsequent to the 
obfuscating instruction, (Column 23, Une 62 - Column 24, line 3) 

Granger fails to explicitly disclose an embodiment wherein the said obfuscating instruction used 
is an interrupt. 



Operating System Concepts, fifth edition, Silberschatz et al. Figure 12.3 and pages 402-404 
discloses inserting an interrupt for causing a currently executing program to not continue its 
execution of instructions subsequent to the interrupt instruction. 
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Operating System Concepts, fifth edition, Silberschatz et al. Figure 12.3 and pages 402-404 
discloses inserting a branch instruction to invoke execution of one or more bytes subsequent to 
the instruction, where the branch instruction is the "return fi-om interrupt" instruction. 

Operating System Concepts, fifth edition, Silberschatz et al. teaches that the basic interrupt 
mechanism enables the CPU to respond asynchronous events. 

It would have been obvious to one of ordinary skill in the art at the time of invention to use an 
interrupt handler to interrupt the obfuscating computer program method of Granger in order to 
allow the computer to respond to asynchronous events in the meantime. 

However, neither Granger nor Operating System Concepts, fifth edition, Silberschatz et al. 
discloses the method of code obfuscation including the step of inserting the following code: 
JMP $+4; 
INT 35h. 

JMP $+4 however is a branch instruction. The Examiner considers jump type instructions to be 
inherent to branch instructions. The two types of instructions are virtually synonymous with one 
another. A branch instruction is understood as an instruction 
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"To relinquish control to another set of instructions or another routine as a result of the presence 
of a branch." 

The Jump instruction is an instruction understood to mean: 

"To move from one set of instructions in a program to another out of sequence." 

(Taken from http://w\vw.dictionarv.com ) 

A branch inherently contains a "jump" when it relinquishes control to another routine, even 
though this may be dependent on a particular condition (conditional branches). 

The Examiner notes that each of these instructions were well known in the art at the time of 
invention. INT 35h is the interrupt to 35h which performs the function of getting the interrupt 
vector. ("Programmer's Guide to the IBM PC", Peter Nortion, 1985, Microsoft Press, pgs, 303, 
49, Figure 3-1) 

JMP $+4 is a command to allow program execution to jump 4 bytes from the current point in 
execution, which is the size of a single word for a 32-bit system. 

The Jump command is disclosed in Turbo Assembler, V 2.5, p.292. 
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However, while each of these commands has a separate utiHty, the search of the prior art has not 
uncovered any art where the code is inserted in consecutive sequence, nor has any motivation 
been found to combine the two commands for specific use in an obfuscation system, particular 
why such code would be inserted as a means of providing obfuscation. 

It is self evident to programmers in the art, that the mere appearance the code JMP $+4 and INT 
35h however may appear in some preexisting code in the prior art. Just as mathematical 
operators such as an addition operator may take any argument x + y = z, so too can assembly 
operators take any arguments a programmer may see fit to use to whatever task he or she may be 
endeavoring to accomplish. 

For this reason, the Examiner previously rendered a similar rejection based on claims 10 and 1 1 
in which the insertion was not made. (See the final rejection of 4/21/05) 

The claim distinguishes from the type of subject matter previously claimed in claims 10 and 1 1 
in that it recites the insertion of these instructions as a means of providing code obfuscation, 
which has an established utility in the art. Additionally, this code is inserted specifically to cause 
a disassembler not to disassemble one or more bytes. Neither motivation to combine, nor any 
prior art disclosure has been found which teaches the combination of elements of claim 4. 
Accordingly, the claim is held to be allowable. 
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Conclusion 



4. 



Any inquiry concerning this communication from the examiner should be directed to 



Thomas M Ho whose telephone number is (571)272-3835. The examiner can normally be 
reached on M-F from 9:30 AM - 6:00 PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, 
Gregory A. Morse can be reached on (571)272-3838. 

The Examiner may also be reached through email through Thomas.Ho6@uspto.gov 

Any inquiry of a general nature or relating to the status of this application or proceeding should 
be directed to the receptionist v^hose telephone number is (571)272-2100. 

General Information/Receptionist Telephone: 571-272-2100 Fax: 571-273-8300 
Customer Service Representative Telephone: 571-272-2100 Pax: 571-273-8300 



November 14^", 2005 



TMH 




